idToCode

Creates an opaque session id ("code") that can be safely given to the client. On the server the session is just identified by its id, which stays the same. When referencing the session from the client, we do not want the client to be able to play any games, thus the actual server-side id and a small amount of metadata is encrypted using server secret key.

We use these codes for many purposes (identified by OpaqueIdType) and always validate that the code we get is actually created for its intended purpose. Also a code contains expiration time, a code can only be used until it expires.